An attacker with full root access could simply use the -a flag to remove this protection. Look into the lcap utility to remove the capability to make this change from the kernel (after which it will take a reboot to restore it).

Setting this attribute will break log rotation. It's a tradeoff between that slight inconvenience and the advantages of much better audit.

-S (note capitalization): The file equivalent of setting
mount -o sync for a directory. Instead of holding the data in a
buffer and writing to disk asynchronously (which improves performance but
slightly increases the risk of data corruption), the write happens
immediately when the change is made. On a per-file basis the performance hit
is minor, so this may be useful, again, for particularly important
files.

The -R flag will set these attributes recursively (chattr -R +i /directory). You can also see the attributes set
for a particular file by using lsattr filename.